Skip to content

ci: repin conformance harness to published 0.2.0-alpha.10 - #3185

Closed
pcarleton wants to merge 2 commits into
mainfrom
paulc/conformance-alpha-10
Closed

ci: repin conformance harness to published 0.2.0-alpha.10#3185
pcarleton wants to merge 2 commits into
mainfrom
paulc/conformance-alpha-10

ci: pin conformance harness by tarball URL + sha256, not version spec

40328e7
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Jul 27, 2026 in 10m 15s

Code review found 2 potential issues

Found 1 candidates, confirmed 2. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 2
🟣 Pre-existing 0
Severity File:Line Issue
🟡 Nit .github/workflows/conformance.yml:17-26 PR description contradicts final diff: sha256 pin and fetch-and-verify steps are kept, not dropped

Annotations

Check warning on line 26 in .github/workflows/conformance.yml

See this annotation in the file changed.

@claude claude / Claude Code Review

PR description contradicts final diff: sha256 pin and fetch-and-verify steps are kept, not dropped

The PR description says this change points `CONFORMANCE_PKG` back at the registry spec and drops `CONFORMANCE_PKG_SHA256` plus the fetch-and-verify steps, but the head commit (40328e7) deliberately reversed that plan — the final diff keeps the sha256 byte-pin and both fetch-and-verify steps, pointing `CONFORMANCE_PKG` at the registry tarball URL instead. A squash-merge message derived from the description would misstate the supply-chain posture (implying npm's weaker integrity check applies when